Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles|Raj Chandel's Blog
Pandora HackTheBox Walkthrough
SummaryPandora is Linux machine and considered as easy box by the hack the box but indeed it is not. With this box we will need to perform other port scan instead of being relied on only TCP ports results. Then we will dig about SNMP protocol and find out a very interesting information for us which will lead us to initial foothold to the target machine. Then we will need to perform Horizontal privilege escalation and local port forward to enumerate service running on target’s internal port. Then we will exploit the admin console which is vulnerable to the SQL injection and upload malicious file to get a reverse shell as a different user. In the post exploitation phase, we will abuse SUID binary using path hijacking technique. <o:pTable of content<o:pInitial Access<o:p
* TCP Port Scan<o:p
* Enumeration<o:p
* UDP Port Scan <o:p
* SNMP Enumeration<o:p
* User Shell as Daniel<o:p Horizontal Privilege Escalation<o:p
* Enumeration<o:p
* Port Forwarding<o:p
* CVE-2021-32099 SQL injection Exploitation<o:p
* File Upload <o:p
* User Flag<o:p Privilege Escalation<o:p
* SSH Key Generate<o:p
* SUID Path hijack<o:p
* Root Flag<o:p
Let’s exploit it step by step.<o:p Initial Access<o:pWe are going to start assessment with the TCP/IP port scanning.<o:p TCP Port Scan<o:pLet’s start with the port scan. We are using nmap to find out which ports are open so we can begin our port and service analyse. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used -sCand -sVflags. <o:p
Flags features:<o:p -sC: Scans with default NSE scripts<o:p -sV: Attempts to determine the service version<o:p Command used:<o:pnmap -sC -sV 10.129.26.243<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggzEIOKKimE5TO1DEb1dOq1Ced9FfQ8yxFD_3qWtKitCIJhWX73NUNykwZV7qG1H-x_YZDGqQUagpjMCzorKJ21k4vkmh0BpM-cE_7qwPmeJqdTSS6qnmxwZZS_G7u7H8Yo9JH29XA5s1FfDUDZ1OYwTDsn7XrGgKuTEqOMd_S_PcwtYX0p40Yx7uoPg/s16000/1.png From the nmap scan, we have found there were only two ports open, which is port 80and port 22. As usual HTTP serviceis running on port 80 and the SSH service is running on port 22. Http service is used for the webhosting and the SSH service is used for remote connection. SSH version is latest and does not look like vulnerable and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to. Instead of thinking about the SSH bruteforce let’s start enumerating port 80. <o:p Enumeration<o:pWe begin enumeration by accessing port 80 over browser. Webpage does not have much interesting things, but we can see domain name is available there which is Panda.htb. Next thing we can analyse what this website made for, and it does. Remember every website is created for some purpose with this mindset we assumed this website is serving games and the network monitoring solutions. <o:p URL: htttp://10.129.26.243https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqOXWdV-BU1atzeRt_jEHloQrnFNDjLuJdrer05e-OY-zJLwxnjpbd6eh5rRxVbDgjc4X2nY6E8cORDvyAy9Byn5GXrVPpmSRCvWYfWsEQjrWdLHx7zE2YZ7jg8Nb4uth35ULKEDAESt0ykZNiU1JxQKNh0ZdhBmJTZtsR5R84ZAL31y40rjRBwcMVug/s16000/2.png UDP Port Scan <o:pGot stuck for some time as we did not get any lead to get foothold into the target system, we decided to perform an UDP port scan. When we do normal nmap scan, it only scans TCP ports but not UDP so many time UDP port may lead us to interesting findings. After the completion of the UDP port scan we found that SNMPport is open on its default port which is port 161. Now we can go for the[...]
Pandora HackTheBox Walkthrough
SummaryPandora is Linux machine and considered as easy box by the hack the box but indeed it is not. With this box we will need to perform other port scan instead of being relied on only TCP ports results. Then we will dig about SNMP protocol and find out a very interesting information for us which will lead us to initial foothold to the target machine. Then we will need to perform Horizontal privilege escalation and local port forward to enumerate service running on target’s internal port. Then we will exploit the admin console which is vulnerable to the SQL injection and upload malicious file to get a reverse shell as a different user. In the post exploitation phase, we will abuse SUID binary using path hijacking technique. <o:pTable of content<o:pInitial Access<o:p
* TCP Port Scan<o:p
* Enumeration<o:p
* UDP Port Scan <o:p
* SNMP Enumeration<o:p
* User Shell as Daniel<o:p Horizontal Privilege Escalation<o:p
* Enumeration<o:p
* Port Forwarding<o:p
* CVE-2021-32099 SQL injection Exploitation<o:p
* File Upload <o:p
* User Flag<o:p Privilege Escalation<o:p
* SSH Key Generate<o:p
* SUID Path hijack<o:p
* Root Flag<o:p
Let’s exploit it step by step.<o:p Initial Access<o:pWe are going to start assessment with the TCP/IP port scanning.<o:p TCP Port Scan<o:pLet’s start with the port scan. We are using nmap to find out which ports are open so we can begin our port and service analyse. Nmap is a popular port scanning tool come with Kali Linux. In order to perform port scan, we have used -sCand -sVflags. <o:p
Flags features:<o:p -sC: Scans with default NSE scripts<o:p -sV: Attempts to determine the service version<o:p Command used:<o:pnmap -sC -sV 10.129.26.243<o:phttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggzEIOKKimE5TO1DEb1dOq1Ced9FfQ8yxFD_3qWtKitCIJhWX73NUNykwZV7qG1H-x_YZDGqQUagpjMCzorKJ21k4vkmh0BpM-cE_7qwPmeJqdTSS6qnmxwZZS_G7u7H8Yo9JH29XA5s1FfDUDZ1OYwTDsn7XrGgKuTEqOMd_S_PcwtYX0p40Yx7uoPg/s16000/1.png From the nmap scan, we have found there were only two ports open, which is port 80and port 22. As usual HTTP serviceis running on port 80 and the SSH service is running on port 22. Http service is used for the webhosting and the SSH service is used for remote connection. SSH version is latest and does not look like vulnerable and the possible attack we can perform against the SSH service at this stage is bruteforce only which we might not need to. Instead of thinking about the SSH bruteforce let’s start enumerating port 80. <o:p Enumeration<o:pWe begin enumeration by accessing port 80 over browser. Webpage does not have much interesting things, but we can see domain name is available there which is Panda.htb. Next thing we can analyse what this website made for, and it does. Remember every website is created for some purpose with this mindset we assumed this website is serving games and the network monitoring solutions. <o:p URL: htttp://10.129.26.243https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqOXWdV-BU1atzeRt_jEHloQrnFNDjLuJdrer05e-OY-zJLwxnjpbd6eh5rRxVbDgjc4X2nY6E8cORDvyAy9Byn5GXrVPpmSRCvWYfWsEQjrWdLHx7zE2YZ7jg8Nb4uth35ULKEDAESt0ykZNiU1JxQKNh0ZdhBmJTZtsR5R84ZAL31y40rjRBwcMVug/s16000/2.png UDP Port Scan <o:pGot stuck for some time as we did not get any lead to get foothold into the target system, we decided to perform an UDP port scan. When we do normal nmap scan, it only scans TCP ports but not UDP so many time UDP port may lead us to interesting findings. After the completion of the UDP port scan we found that SNMPport is open on its default port which is port 161. Now we can go for the[...]
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Overview eJPT - Matheus Gutierre
https://cdn-images-1.medium.com/max/1209/1*PF5YNZHpY_F_NWd-U6F6LA.png
17th of December 2022 — O dia em que fui aprovado na eLean Junior Prenetration Tester. Essa prova consiste em 20 questões, onde a taxa…
Continue reading on Medium »
Overview eJPT - Matheus Gutierre
https://cdn-images-1.medium.com/max/1209/1*PF5YNZHpY_F_NWd-U6F6LA.png
17th of December 2022 — O dia em que fui aprovado na eLean Junior Prenetration Tester. Essa prova consiste em 20 questões, onde a taxa…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
how to get instagram reels bonus in pakistan
Instagram Reels is a new feature that allows users to create 15-second videos set to music.
Continue reading on Medium »
how to get instagram reels bonus in pakistan
Instagram Reels is a new feature that allows users to create 15-second videos set to music.
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
HackTheBox writeup — Meow
https://cdn-images-1.medium.com/max/700/1*i8etBSE5Q7NlNbGJUDrmAw.jpeg
This is I would say a realy easy machine as it has only the Telnet tcp port 23 that we are targeting. Here you can find out more about…
Continue reading on Medium »
HackTheBox writeup — Meow
https://cdn-images-1.medium.com/max/700/1*i8etBSE5Q7NlNbGJUDrmAw.jpeg
This is I would say a realy easy machine as it has only the Telnet tcp port 23 that we are targeting. Here you can find out more about…
Continue reading on Medium »
Hacking on Medium
Tik Tok’s Secret Weapon
https://cdn-images-1.medium.com/max/1640/1*yBf_COFRsSbdTeKzCtDVaQ.png
It is no surprise that TikTok has gained such widespread popularity in recent years. The app’s advanced artificial intelligence (AI) has…
Continue reading on Medium »
Tik Tok’s Secret Weapon
https://cdn-images-1.medium.com/max/1640/1*yBf_COFRsSbdTeKzCtDVaQ.png
It is no surprise that TikTok has gained such widespread popularity in recent years. The app’s advanced artificial intelligence (AI) has…
Continue reading on Medium »
Medium
Tik Tok’s Secret Weapon
It is no surprise that TikTok has gained such widespread popularity in recent years. The app’s advanced artificial intelligence (AI) has…
Hacking on Medium
Dünya tarihinin en büyük siber saldırıları
https://cdn-images-1.medium.com/max/1920/1*FEaLOrIceoL_WwpHFPQ_cg.jpeg
Dünya tarihinde birçok büyük siber saldırı olmuştur. Ancak aşağıdaki saldırıların büyüklüğü ve etkileri nedeniyle öne çıkmıştır:
Continue reading on Medium »
Dünya tarihinin en büyük siber saldırıları
https://cdn-images-1.medium.com/max/1920/1*FEaLOrIceoL_WwpHFPQ_cg.jpeg
Dünya tarihinde birçok büyük siber saldırı olmuştur. Ancak aşağıdaki saldırıların büyüklüğü ve etkileri nedeniyle öne çıkmıştır:
Continue reading on Medium »
Medium
Dünya tarihinin en büyük siber saldırıları
Dünya tarihinde birçok büyük siber saldırı olmuştur. Ancak aşağıdaki saldırıların büyüklüğü ve etkileri nedeniyle öne çıkmıştır:
Hacking on Medium
TryHackMe Advent of Cyber [Day 17]-> Secure Coding: Order From Chaos with Regex
https://cdn-images-1.medium.com/max/1052/1*93SaY1qU-TwHu3FxKQ_nGg.jpeg
We already learned a lot about validating input in the secure coding challenges on days 15 and 16. Today we expand on that further using…
Continue reading on Medium »
TryHackMe Advent of Cyber [Day 17]-> Secure Coding: Order From Chaos with Regex
https://cdn-images-1.medium.com/max/1052/1*93SaY1qU-TwHu3FxKQ_nGg.jpeg
We already learned a lot about validating input in the secure coding challenges on days 15 and 16. Today we expand on that further using…
Continue reading on Medium »
Medium
TryHackMe Advent of Cyber [Day 17]-> Secure Coding: Order From Chaos with Regex
We already learned a lot about validating input in the secure coding challenges on days 15 and 16. Today we expand on that further using…
HTTP nedirContinue reading on Medium » (https://ozkanaltunbas.medium.com/http-analizi-a5f17e5ecaba?source=rss------bug_bounty-5)